General

  • Target

    19b93ddb8c8837f6b679249c1a677b0f_JaffaCakes118

  • Size

    360KB

  • Sample

    240505-3l8w7scg29

  • MD5

    19b93ddb8c8837f6b679249c1a677b0f

  • SHA1

    d6966a2de8143c7dc1cef1d70cdea6166015a21a

  • SHA256

    9ba49f2fe2369c9510a87dc83cd49bd7d17d603e009e46b09b8bb1910254c54e

  • SHA512

    1e0f8aa663746e26b03fb4b9f6a58b6f4ed685b14135e4d01efa9678dda8ea1090479f1a6562df96e3bdc69437bd34154bf2eb9b2904051a8cb2f8d26692da20

  • SSDEEP

    6144:fI7kmNy3NyW7btm58icJp8DbxCuoAgUPL26GCFF:fI7kmNy3NyUmMJp8Db8jAVPL26GCH

Score
10/10

Malware Config

Targets

    • Target

      19b93ddb8c8837f6b679249c1a677b0f_JaffaCakes118

    • Size

      360KB

    • MD5

      19b93ddb8c8837f6b679249c1a677b0f

    • SHA1

      d6966a2de8143c7dc1cef1d70cdea6166015a21a

    • SHA256

      9ba49f2fe2369c9510a87dc83cd49bd7d17d603e009e46b09b8bb1910254c54e

    • SHA512

      1e0f8aa663746e26b03fb4b9f6a58b6f4ed685b14135e4d01efa9678dda8ea1090479f1a6562df96e3bdc69437bd34154bf2eb9b2904051a8cb2f8d26692da20

    • SSDEEP

      6144:fI7kmNy3NyW7btm58icJp8DbxCuoAgUPL26GCFF:fI7kmNy3NyUmMJp8Db8jAVPL26GCH

    Score
    10/10
    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks